Similar as \(R_0(\theta ^*(\delta ),\delta )\) , the standard risk of the adversarially robust model \(R_0(\theta ^*(\delta ),0)\)  also increases as \(\delta \)  and reaches the same level as \(R_0(\theta ^*(\delta ),\delta )\)  when \(\delta >1/c_0\) ; see Figure REF  below. This result echoes with [1]}, [2]} that the adversarially robust model leads to a worse performance when testing data is un-corrupted.
<FIGURE>